Wow Martin, that's fantastic. I'm sure I'm not the only person interested in this type of thing. Thanks from me and the community! ... View more

I have also just heard of this nice little solution in-between indexing none and all such events. ... View more

@jeremyarcher You're adding on to a question that is more than three years old and has an accepted answer. For better chances at getting help, please post a new question describing your problem. ... View more

Thomas, did this come up because of the log data you're getting or because the data (proxy WC3 logs) are there but the field extraction is failing? When you mentioned Cisco proxy I'm assuming you're using Cisco CWS / Scansafe? Almost all of the log data I get (using sourcetype = aws:s3) from Scansafe via AWS is: #Fields: datatime c-ip cs(X-Forwarded-For) cs-username cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs(User-Agent) cs(Content-Type) cs-bytes sc-bytes sc-status sc(Content-Type) s-ip x-ss-category x-ss-last-rule-name x-ss-last-rule-action x-ss-block-type x-ss-block-value x-ss-external-ip x-ss-referer-host ... View more

Try this base search: sourcetype=WindowsSecurityEvents | streamstats last(host) AS prevHost BY username | streamstats last(username) AS prevUsername BY host For the first example to show events where a single username was on multiple hosts yo tack on this: | where prevHost!=host For the first example to show events where a single username was on multiple hosts yo tack on this: | where prevUsername!=username ... View more

I am having difficulties with compiling Cisco wireless MIBS too. This is really painful and I've tried everything. Nothing works: root@CZ-SLG003:~/mibs/cisco/wlc/8.5/all# mibdump.py CISCO-LWAPP-DOT11-CLIENT-MIB.my Source MIB repositories: file:///usr/share/snmp/mibs, http://mibs.snmplabs.com/asn1/@mib@ Borrow missing/failed MIBs from: http://mibs.snmplabs.com/pysnmp/notexts/@mib@ Existing/compiled MIB locations: pysnmp.smi.mibs, pysnmp_mibs Compiled MIBs destination directory: /root/.pysnmp/mibs MIBs excluded from code generation: INET-ADDRESS-MIB, PYSNMP-USM-MIB, RFC-1212, RFC-1215, RFC1065-SMI, RFC1155-SMI, RFC1158-MIB, RFC1213-MIB, SNMP-FRAMEWORK-MIB, SNMP-TARGET-MIB, SNMPv2-CONF, SNMPv2-SMI, SNMPv2-TC, SNMPv2-TM, TRANSPORT-ADDRESS-MIB MIBs to compile: CISCO-LWAPP-DOT11-CLIENT-MIB Destination format: pysnmp Parser grammar cache directory: not used Also compile all relevant MIBs: yes Rebuild MIBs regardless of age: no Dry run mode: no Create/update MIBs: yes Byte-compile Python modules: yes (optimization level no) Ignore compilation errors: no Generate OID->MIB index: no Generate texts in MIBs: no Keep original texts layout: no Try various file names while searching for MIB module: yes Created/updated MIBs: Pre-compiled MIBs borrowed: Up to date MIBs: BRIDGE-MIB, CISCO-LWAPP-DOT11-CLIENT-MIB, CISCO-LWAPP-DOT11-MIB, CISCO-LWAPP-MOBILITY-EXT-MIB, CISCO-LWAPP-RF-MIB, CISCO-LWAPP-TC-MIB, CISCO-LWAPP-WLAN-MIB, CISCO-SMI, CISCO-TC, ENTITY-MIB, IANAifType-MIB, IF-MIB, INET-ADDRESS-MIB, P-BRIDGE-MIB, Q-BRIDGE-MIB, RFC-1212, RFC-1215, RFC1155-SMI, RFC1213-MIB, RFC1271-MIB, RMON-MIB, RMON2-MIB, SNMP-FRAMEWORK-MIB, SNMPv2-CONF, SNMPv2-MIB, SNMPv2-SMI, SNMPv2-TC, TOKEN-RING-RMON-MIB Missing source MIBs: Ignored MIBs: Failed MIBs: CISCO-LWAPP-AP-MIB (unknown type "(('Integer32', ''), [(u'true', 1), (u'false', 2)])" for defval "disable" of symbol "cLApCtsSxpMode" at MIB CISCO-LWAPP-AP-MIB) root@CZ-SLG003:~/mibs/cisco/wlc/8.5/all# ... View more

This add-on was very straight forward to setup. I ran into a lot of issues with the AWS Add-on version 3.0.0 and this CWS Add-on saved me a lot of headaches. Highly recommend it. ... View more

I added the last change above, hopefully that works for you. Sorry for the late response, it took some time from support. Also, support said this is a bug that will be fixed in a future release of the app. ... View more